CLAIMS 

What is claimed is: 



1 1 . A method of reconstructing a session, the method comprising: 

2 receiving a plurality of packets over a network interface; 

3 analyzing the plurality of packets to identify at least a first flow; 

4 identifying an applicationVor the at least a first flow; 

5 selecting a corresponding application flow identifier for the application; 

6 using the corresponding application flow identifier to identify a plurality of flows in 
|3 7 the plurality of packets corresponding to the session. 

>9 \ 

Uj 1 2. The method of claim 1 further comprising generating a quality of service report for the 

Sf= \ 

H 2 session based on the application. yV V 

14 ( \ }\ 

h [ y \ 

* 1 3. The method of claim 1 wherein the session ^associated with an end user experience 

C3 \ 

J!l 2 occurring within a definite time bound. \ 

IV \ 

f ~f 1 4, The method of claim 3 wherein the session is comprised of one or more additional 

2 sessions. V 

1 5. The method of claim 1 further comprising filtering the plurality of packets received 

2 over the network interface prior to the analyzing, the filtering Comprising removing one or 

3 more packets from the plurality of packets according to one or mbre packet capture language 

4 rules. \ 



C:\NrPortbl\PAUB t\clo\l 1 33594,2.DOC 



25 



Attorney Docket Number. 19623-707 



ry 



16. . The method oYclaim 1 further comprising outputting a plurality of service detail 

2 records at predetermined intervals for the application, each service detail record including a 

3 billing identifier and a usage information, the usage information derived from the number of 

4 packets in the session duringVhe corresponding predetermined interval. 



1 
2 

: 3 

LILs 
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7. The method of claim 1 rarther comprising sending a command to a network device to 
control the session based on a polipy, the policy defining a quality of service for the 
application. 

8. The method of claim 1 further Comprising sending a command to a network device to 
control the session based on a policy, th^policy defining the amount of resources available to 
the session. 



H 1 9. The method of claim 1 further comprismg^sending a command to a network device to 

W 2 stop the session based on a policy, the policy sge^fying a cost for use of resources and the 

3 policy triggering the transmission of the command ^pon the cost exceeding a predetermined 

4 amount. 



1 10. A system for reconstructing a session, the systen^comprising: 

2 a packet source, the packet source generating a plurality of packets; 

3 a flow manager coupled to the packet source, the Aom( manager identifying at least one 

4 flow in the plurality of packets; 

5 an application recognizer coupled to the flow manager, ttie application recognizer 

6 identifying an application corresponding to the at least one flow; 
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a session streamer coupled to the flow manager, the session streamer identifying a 
plurality onflows in the plurality of packets corresponding to the session based on 
the application 



i'3 



$ . i 



ry 



1 11. The system of claimM 0, wherein each of the plurality of packets includes a plurality of 

2 header elements and the at least one flow includes one or more packets with a common packet 

3 header element: 

1 12. The system of claim 10, wherein the application recognizer can identify at least one of 

2 a file transfer protocol (FTP), a hypertext transfer protocol (HTTP), a simple mail transport 

3 protocol (SMTP), a domain name.servicA(DNS), a telnet protocol, a post office protocol 



fi 4 (POP), an Internet message access protocolYlMAP), a network time protocol (NTP), a 



5 Netbios protocol, a network news transport p^Dtocbl (NNTP), a network time protocol (NTP), 

6 a simple network management protocol (SNMR)/ Wi Internet Relay Chat (IRC) protocol, a 



m 7 



H.323 protocol, a voice over IP protocol, a NetMeeting(TM) protocol, a Quicktime(TM) 
8 protocol, a server message block (SMB) protocol, a\RealAudio(TM) protocol, a real time 

Q \ 

M 9 streaming protocol (RTSP), and a real-time transport protocol (RTP). 



1 13. The system of claim 10, wherein the application recognizer signals to the session 

2 streamer to treat the at least one flow as a session when theyapplication recognizer cannot 

3 identify an application for the at least one flow: 

1 14. The system of claim 10, further comprising a data collector coupled to the session 

2 streamer, the data collector for producing service detail records at predetermined intervals for 
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the application corresponding to the session, each service detail record including a billing 
identifier and a usage inforaiation. 



15. 



An apparatus for reconstructing a session, the apparatus comprising: 
means for receiving a plurality of packets; 

means for identifying at least a first flow in the plurality of packets; 
means for identifying an application for the at least a first flow; 
means for selecting a corresponding application flow identifier for the application; 
means for identifying a plurality of flows in the plurality of packets corresponding to 
the session using the corresponding application flow identifier. 



\ 



16. The apparatus of claim 15, further comprising means for reporting application 



appropriate performance characteristics for 



session. 



17. The apparatus of claim 15, further COTupnsing means for controlling a network device 
according to a policy, the policy defining the amou^of resources available to the session. 

18. The apparatus of claim 15, further comprisingymeans for charging at least one account 
for resources used during the session. 

19. A computer data signal embodied in a carrier wave % comprising: 
a computer program for session reconstruction: 

a first set of instructions for identifying at least onfe flow in a plurality of packets; 
a second set of instructions, for analyzing the at leas^one flow to identify an 
application corresponding to the flow; and 
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